Listen to this Post
The vulnerability is a type confusion issue in the Linux kernel’s SMC (Shared Memory Communications) subsystem. A previous commit allowed an `smc_sock` structure to be incorrectly treated as an `inet_sock` structure. This occurs because `struct smc_sock` does not have `struct inet_sock` as its first member, but it hijacks the AF_INET/AF_INET6 socket families. Consequently, code paths expecting a true INET socket, like cipso_v4_sock_setattr(), can misinterpret the memory layout. For example, when the kernel attempts to access inet_sk(sk)->inet_opt, it is actually accessing the `smc_sock.clcsk_data_ready` function pointer. Attempts to free this function pointer as if it were kernel data (a struct ip_options_rcu) lead to memory corruption, triggering kernel oopses, double-frees, and potential system crashes.
Platform: Linux Kernel
Version: Up to 6.16-rc4
Vulnerability: Type Confusion
Severity: Critical
date: 07/28/2025
Prediction: Patch expected 07/29/2025
What Undercode Say:
pahole -C inet_sock vmlinux pahole -C smc_sock vmlinux dmesg | grep "Double-freed" cat /proc/version
// Code accessing inet_opt struct ip_options_rcu opt = inet_sk(sk)->inet_opt; // ... which is actually clcsk_data_ready in an smc_sock
How Exploit:
Kernel panic/oops.
Memory corruption.
Double-free crash.
System instability.
Protection from this CVE
Apply kernel patch.
Update to fixed version.
Disable SMC module.
Impact:
Denial-of-service.
System crash.
Privilege escalation possible.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
